Less as * in library/core

`cast`/`cast_const`/`cast_mut` have been stable and const-stable for a while, so let's use them instead of `as`, for clarity about what the cast is doing and to emphasize `as` casts doing anything else.

After all, if it had existed back then, using `.cast::<T>()` instead of `as *mut T` would have helped catch the soundness bug back in <https://blog.rust-lang.org/2017/02/09/Rust-1.15.1.html#whats-in-1151-stable>.

I'm working on a lint to enforce this, which is how I found all these cases :)

Old zulip conversation about moving things off `as` where feasible: <https://rust-lang.zulipchat.com/#narrow/stream/219381-t-libs/topic/Adding.20methods.20as.20more.20specific.20versions.20of.20.60as.60/near/238374585>.

Author: scottmcm

library/core/src/array/mod.rs

@@ -253,7 +253,7 @@ impl<'a, T, const N: usize> TryFrom<&'a [T]> for &'a [T; N] {
 
     fn try_from(slice: &[T]) -> Result<&[T; N], TryFromSliceError> {
         if slice.len() == N {
-            let ptr = slice.as_ptr() as *const [T; N];
+            let ptr = slice.as_ptr().cast::<[T; N]>();
             // SAFETY: ok because we just checked that the length fits
             unsafe { Ok(&*ptr) }
         } else {
@@ -280,7 +280,7 @@ impl<'a, T, const N: usize> TryFrom<&'a mut [T]> for &'a mut [T; N] {
 
     fn try_from(slice: &mut [T]) -> Result<&mut [T; N], TryFromSliceError> {
         if slice.len() == N {
-            let ptr = slice.as_mut_ptr() as *mut [T; N];
+            let ptr = slice.as_mut_ptr().cast::<[T; N]>();
             // SAFETY: ok because we just checked that the length fits
             unsafe { Ok(&mut *ptr) }
         } else {

library/core/src/cell.rs

@@ -624,7 +624,7 @@ impl<T, const N: usize> Cell<[T; N]> {
     #[unstable(feature = "as_array_of_cells", issue = "88248")]
     pub fn as_array_of_cells(&self) -> &[Cell<T>; N] {
         // SAFETY: `Cell<T>` has the same memory layout as `T`.
-        unsafe { &*(self as *const Cell<[T; N]> as *const [Cell<T>; N]) }
+        unsafe { &*ptr::from_ref(self).cast::<[Cell<T>; N]>() }
     }
 }
 

library/core/src/hash/mod.rs

@@ -835,7 +835,7 @@ mod impls {
                 #[inline]
                 fn hash_slice<H: ~const Hasher>(data: &[$ty], state: &mut H) {
                     let newlen = mem::size_of_val(data);
-                    let ptr = data.as_ptr() as *const u8;
+                    let ptr = data.as_ptr().cast::<u8>();
                     // SAFETY: `ptr` is valid and aligned, as this macro is only used
                     // for numeric primitives which have no padding. The new slice only
                     // spans across `data` and is never mutated, and its total size is the

library/core/src/iter/adapters/copied.rs

@@ -223,7 +223,7 @@ where
             unsafe {
                 ptr::copy_nonoverlapping(
                     self.as_ref().as_ptr(),
-                    raw_array.as_mut_ptr() as *mut T,
+                    raw_array.as_mut_ptr().cast::<T>(),
                     len,
                 );
                 let _ = self.advance_by(len);
@@ -234,7 +234,7 @@ where
         // SAFETY: `len` is larger than the array size. Copy a fixed amount here to fully initialize
         // the array.
         unsafe {
-            ptr::copy_nonoverlapping(self.as_ref().as_ptr(), raw_array.as_mut_ptr() as *mut T, N);
+            ptr::copy_nonoverlapping(self.as_ref().as_ptr(), raw_array.as_mut_ptr().cast::<T>(), N);
             let _ = self.advance_by(N);
             Ok(MaybeUninit::array_assume_init(raw_array))
         }

library/core/src/mem/maybe_uninit.rs

@@ -527,7 +527,8 @@ impl<T> MaybeUninit<T> {
     #[inline(always)]
     pub const fn as_ptr(&self) -> *const T {
         // `MaybeUninit` and `ManuallyDrop` are both `repr(transparent)` so we can cast the pointer.
-        self as *const _ as *const T
+        // FIXME: consider `ptr::from_ref` once that's const-stable
+        ptr::addr_of!(*self).cast::<T>()
     }
 
     /// Gets a mutable pointer to the contained value. Reading from this pointer or turning it
@@ -566,7 +567,7 @@ impl<T> MaybeUninit<T> {
     #[inline(always)]
     pub const fn as_mut_ptr(&mut self) -> *mut T {
         // `MaybeUninit` and `ManuallyDrop` are both `repr(transparent)` so we can cast the pointer.
-        self as *mut _ as *mut T
+        ptr::from_mut(self).cast::<T>()
     }
 
     /// Extracts the value from the `MaybeUninit<T>` container. This is a great way
@@ -947,7 +948,7 @@ impl<T> MaybeUninit<T> {
         // And thus the conversion is safe
         let ret = unsafe {
             intrinsics::assert_inhabited::<[T; N]>();
-            (&array as *const _ as *const [T; N]).read()
+            ptr::from_ref(&array).cast::<[T; N]>().read()
         };
 
         // FIXME: required to avoid `~const Destruct` bound
@@ -1002,15 +1003,15 @@ impl<T> MaybeUninit<T> {
     #[rustc_const_unstable(feature = "maybe_uninit_slice", issue = "63569")]
     #[inline(always)]
     pub const fn slice_as_ptr(this: &[MaybeUninit<T>]) -> *const T {
-        this.as_ptr() as *const T
+        this.as_ptr().cast::<T>()
     }
 
     /// Gets a mutable pointer to the first element of the array.
     #[unstable(feature = "maybe_uninit_slice", issue = "63569")]
     #[rustc_const_unstable(feature = "maybe_uninit_slice", issue = "63569")]
     #[inline(always)]
     pub const fn slice_as_mut_ptr(this: &mut [MaybeUninit<T>]) -> *mut T {
-        this.as_mut_ptr() as *mut T
+        this.as_mut_ptr().cast::<T>()
     }
 
     /// Copies the elements from `src` to `this`, returning a mutable reference to the now initialized contents of `this`.
@@ -1182,7 +1183,7 @@ impl<T> MaybeUninit<T> {
     pub fn as_bytes(&self) -> &[MaybeUninit<u8>] {
         // SAFETY: MaybeUninit<u8> is always valid, even for padding bytes
         unsafe {
-            slice::from_raw_parts(self.as_ptr() as *const MaybeUninit<u8>, mem::size_of::<T>())
+            slice::from_raw_parts(self.as_ptr().cast::<MaybeUninit<u8>>(), mem::size_of::<T>())
         }
     }
 
@@ -1214,7 +1215,7 @@ impl<T> MaybeUninit<T> {
         // SAFETY: MaybeUninit<u8> is always valid, even for padding bytes
         unsafe {
             slice::from_raw_parts_mut(
-                self.as_mut_ptr() as *mut MaybeUninit<u8>,
+                self.as_mut_ptr().cast::<MaybeUninit<u8>>(),
                 mem::size_of::<T>(),
             )
         }
@@ -1244,7 +1245,7 @@ impl<T> MaybeUninit<T> {
         // SAFETY: MaybeUninit<u8> is always valid, even for padding bytes
         unsafe {
             slice::from_raw_parts(
-                this.as_ptr() as *const MaybeUninit<u8>,
+                this.as_ptr().cast::<MaybeUninit<u8>>(),
                 this.len() * mem::size_of::<T>(),
             )
         }
@@ -1277,7 +1278,7 @@ impl<T> MaybeUninit<T> {
         // SAFETY: MaybeUninit<u8> is always valid, even for padding bytes
         unsafe {
             slice::from_raw_parts_mut(
-                this.as_mut_ptr() as *mut MaybeUninit<u8>,
+                this.as_mut_ptr().cast::<MaybeUninit<u8>>(),
                 this.len() * mem::size_of::<T>(),
             )
         }

library/core/src/mem/mod.rs

@@ -1054,12 +1054,12 @@ pub const unsafe fn transmute_copy<Src, Dst>(src: &Src) -> Dst {
     if align_of::<Dst>() > align_of::<Src>() {
         // SAFETY: `src` is a reference which is guaranteed to be valid for reads.
         // The caller must guarantee that the actual transmutation is safe.
-        unsafe { ptr::read_unaligned(src as *const Src as *const Dst) }
+        unsafe { ptr::from_ref(src).cast::<Dst>().read_unaligned() }
     } else {
         // SAFETY: `src` is a reference which is guaranteed to be valid for reads.
         // We just checked that `src as *const Dst` was properly aligned.
         // The caller must guarantee that the actual transmutation is safe.
-        unsafe { ptr::read(src as *const Src as *const Dst) }
+        unsafe { ptr::from_ref(src).cast::<Dst>().read() }
     }
 }
 

library/core/src/ptr/const_ptr.rs

@@ -48,7 +48,7 @@ impl<T: ?Sized> *const T {
         }
 
         // SAFETY: The two versions are equivalent at runtime.
-        unsafe { const_eval_select((self as *const u8,), const_impl, runtime_impl) }
+        unsafe { const_eval_select((self.cast::<u8>(),), const_impl, runtime_impl) }
     }
 
     /// Casts to a pointer of another type.
@@ -95,7 +95,7 @@ impl<T: ?Sized> *const T {
     where
         U: ?Sized,
     {
-        from_raw_parts::<U>(self as *const (), metadata(meta))
+        from_raw_parts::<U>(self.cast::<()>(), metadata(meta))
     }
 
     /// Changes constness without changing the type.
@@ -400,7 +400,7 @@ impl<T: ?Sized> *const T {
     {
         // SAFETY: the caller must guarantee that `self` meets all the
         // requirements for a reference.
-        if self.is_null() { None } else { Some(unsafe { &*(self as *const MaybeUninit<T>) }) }
+        if self.is_null() { None } else { Some(unsafe { &*self.cast::<MaybeUninit<T>>() }) }
     }
 
     /// Calculates the offset from a pointer.
@@ -822,7 +822,7 @@ impl<T: ?Sized> *const T {
     where
         T: Sized,
     {
-        match intrinsics::ptr_guaranteed_cmp(self as _, other as _) {
+        match intrinsics::ptr_guaranteed_cmp(self, other) {
             2 => None,
             other => Some(other == 1),
         }

library/core/src/ptr/mod.rs

@@ -1278,7 +1278,7 @@ pub const unsafe fn read_unaligned<T>(src: *const T) -> T {
     // Also, since we just wrote a valid value into `tmp`, it is guaranteed
     // to be properly initialized.
     unsafe {
-        copy_nonoverlapping(src as *const u8, tmp.as_mut_ptr() as *mut u8, mem::size_of::<T>());
+        copy_nonoverlapping(src.cast::<u8>(), tmp.as_mut_ptr().cast::<u8>(), mem::size_of::<T>());
         tmp.assume_init()
     }
 }
@@ -1473,7 +1473,7 @@ pub const unsafe fn write_unaligned<T>(dst: *mut T, src: T) {
     // `dst` cannot overlap `src` because the caller has mutable access
     // to `dst` while `src` is owned by this function.
     unsafe {
-        copy_nonoverlapping(&src as *const T as *const u8, dst as *mut u8, mem::size_of::<T>());
+        copy_nonoverlapping(addr_of!(src).cast::<u8>(), dst.cast::<u8>(), mem::size_of::<T>());
         // We are calling the intrinsic directly to avoid function calls in the generated code.
         intrinsics::forget(src);
     }

library/core/src/ptr/mut_ptr.rs

@@ -412,7 +412,7 @@ impl<T: ?Sized> *mut T {
     {
         // SAFETY: the caller must guarantee that `self` meets all the
         // requirements for a reference.
-        if self.is_null() { None } else { Some(unsafe { &*(self as *const MaybeUninit<T>) }) }
+        unsafe { self.cast_const().as_uninit_ref() }
     }
 
     /// Calculates the offset from a pointer.
@@ -476,7 +476,7 @@ impl<T: ?Sized> *mut T {
         // SAFETY: the caller must uphold the safety contract for `offset`.
         // The obtained pointer is valid for writes since the caller must
         // guarantee that it points to the same allocated object as `self`.
-        unsafe { intrinsics::offset(self, count) as *mut T }
+        unsafe { intrinsics::offset(self, count).cast_mut() }
     }
 
     /// Calculates the offset from a pointer in bytes.
@@ -555,7 +555,7 @@ impl<T: ?Sized> *mut T {
         T: Sized,
     {
         // SAFETY: the `arith_offset` intrinsic has no prerequisites to be called.
-        unsafe { intrinsics::arith_offset(self, count) as *mut T }
+        unsafe { intrinsics::arith_offset(self, count).cast_mut() }
     }
 
     /// Calculates the offset from a pointer in bytes using wrapping arithmetic.
@@ -717,7 +717,7 @@ impl<T: ?Sized> *mut T {
     {
         // SAFETY: the caller must guarantee that `self` meets all the
         // requirements for a reference.
-        if self.is_null() { None } else { Some(unsafe { &mut *(self as *mut MaybeUninit<T>) }) }
+        if self.is_null() { None } else { Some(unsafe { &mut *self.cast::<MaybeUninit<T>>() }) }
     }
 
     /// Returns whether two pointers are guaranteed to be equal.
@@ -744,7 +744,7 @@ impl<T: ?Sized> *mut T {
     where
         T: Sized,
     {
-        (self as *const T).guaranteed_eq(other as _)
+        self.cast_const().guaranteed_eq(other.cast_const())
     }
 
     /// Returns whether two pointers are guaranteed to be inequal.
@@ -771,7 +771,7 @@ impl<T: ?Sized> *mut T {
     where
         T: Sized,
     {
-        (self as *const T).guaranteed_ne(other as _)
+        self.cast_const().guaranteed_ne(other.cast_const())
     }
 
     /// Calculates the distance between two pointers. The returned value is in
@@ -864,7 +864,7 @@ impl<T: ?Sized> *mut T {
         T: Sized,
     {
         // SAFETY: the caller must uphold the safety contract for `offset_from`.
-        unsafe { (self as *const T).offset_from(origin) }
+        unsafe { self.cast_const().offset_from(origin) }
     }
 
     /// Calculates the distance between two pointers. The returned value is in
@@ -955,7 +955,7 @@ impl<T: ?Sized> *mut T {
         T: Sized,
     {
         // SAFETY: the caller must uphold the safety contract for `sub_ptr`.
-        unsafe { (self as *const T).sub_ptr(origin) }
+        unsafe { self.cast_const().sub_ptr(origin) }
     }
 
     /// Calculates the offset from a pointer (convenience for `.offset(count as isize)`).

library/core/src/slice/ascii.rs

@@ -271,7 +271,7 @@ fn is_ascii(s: &[u8]) -> bool {
 
     let start = s.as_ptr();
     // SAFETY: We verify `len < USIZE_SIZE` above.
-    let first_word = unsafe { (start as *const usize).read_unaligned() };
+    let first_word = unsafe { start.cast::<usize>().read_unaligned() };
 
     if contains_nonascii(first_word) {
         return false;
@@ -283,7 +283,7 @@ fn is_ascii(s: &[u8]) -> bool {
 
     // SAFETY: word_ptr is the (properly aligned) usize ptr we use to read the
     // middle chunk of the slice.
-    let mut word_ptr = unsafe { start.add(offset_to_aligned) as *const usize };
+    let mut word_ptr = unsafe { start.add(offset_to_aligned).cast::<usize>() };
 
     // `byte_pos` is the byte index of `word_ptr`, used for loop end checks.
     let mut byte_pos = offset_to_aligned;
@@ -322,7 +322,7 @@ fn is_ascii(s: &[u8]) -> bool {
     debug_assert!(byte_pos <= len && len - byte_pos <= USIZE_SIZE);
 
     // SAFETY: This relies on `len >= USIZE_SIZE`, which we check at the start.
-    let last_word = unsafe { (start.add(len - USIZE_SIZE) as *const usize).read_unaligned() };
+    let last_word = unsafe { start.add(len - USIZE_SIZE).cast::<usize>().read_unaligned() };
 
     !contains_nonascii(last_word)
 }